import{a as h}from"./chunk-2YUF6TO6.js";import{e as A,j as C}from"./chunk-224RJRPV.js";import{a as T}from"./chunk-CHWVD37K.js";import"./chunk-XB6R2VIU.js";import{a as l}from"./chunk-3T4EOSMQ.js";import{b as a}from"./chunk-TX7AAHER.js";import"./chunk-FSRPMVAS.js";import g from"fs/promises";var u="169.254.170.2",R="169.254.170.23",w="[fd00:ec2::23]",p=(e,o)=>{if(e.protocol!=="https:"&&!(e.hostname===u||e.hostname===R||e.hostname===w)){if(e.hostname.includes("[")){if(e.hostname==="[::1]"||e.hostname==="[0000:0000:0000:0000:0000:0000:0000:0001]")return}else{if(e.hostname==="localhost")return;let n=e.hostname.split("."),r=t=>{let s=parseInt(t,10);return 0<=s&&s<=255};if(n[0]==="127"&&r(n[1])&&r(n[2])&&r(n[3])&&n.length===4)return}throw new a(`URL not accepted. It must either be HTTPS or match one of the following:
  - loopback CIDR 127.0.0.0/8 or [::1/128]
  - ECS container host 169.254.170.2
  - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:o})}};function _(e){return new T({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((o,[n,r])=>(o[n]=r,o),{}),fragment:e.hash})}async function I(e,o){let r=await h(e.body).transformToString();if(e.statusCode===200){let t=JSON.parse(r);if(typeof t.AccessKeyId!="string"||typeof t.SecretAccessKey!="string"||typeof t.Token!="string"||typeof t.Expiration!="string")throw new a("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }",{logger:o});return{accessKeyId:t.AccessKeyId,secretAccessKey:t.SecretAccessKey,sessionToken:t.Token,expiration:C(t.Expiration)}}if(e.statusCode>=400&&e.statusCode<500){let t={};try{t=JSON.parse(r)}catch{}throw Object.assign(new a(`Server responded with status: ${e.statusCode}`,{logger:o}),{Code:t.Code,Message:t.Message})}throw new a(`Server responded with status: ${e.statusCode}`,{logger:o})}var f=(e,o,n)=>async()=>{for(let r=0;r<o;++r)try{return await e()}catch{await new Promise(s=>setTimeout(s,n))}return await e()};var S="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",O="http://169.254.170.2",L="AWS_CONTAINER_CREDENTIALS_FULL_URI",y="AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",v="AWS_CONTAINER_AUTHORIZATION_TOKEN",U=(e={})=>{e.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");let o,n=e.awsContainerCredentialsRelativeUri??process.env[S],r=e.awsContainerCredentialsFullUri??process.env[L],t=e.awsContainerAuthorizationToken??process.env[v],s=e.awsContainerAuthorizationTokenFile??process.env[y],i=e.logger?.constructor?.name==="NoOpLogger"||!e.logger?.warn?console.warn:e.logger.warn.bind(e.logger);if(n&&r&&(i("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."),i("awsContainerCredentialsFullUri will take precedence.")),t&&s&&(i("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."),i("awsContainerAuthorizationToken will take precedence.")),r)o=r;else if(n)o=`${O}${n}`;else throw new a(`No HTTP credential provider host provided.
Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let m=new URL(o);p(m,e.logger);let E=A.create({requestTimeout:e.timeout??1e3,connectionTimeout:e.timeout??1e3});return f(async()=>{let c=_(m);t?c.headers.Authorization=t:s&&(c.headers.Authorization=(await g.readFile(s)).toString());try{let d=await E.handle(c);return I(d.response).then(N=>l(N,"CREDENTIALS_HTTP","z"))}catch(d){throw new a(String(d),{logger:e.logger})}},e.maxRetries??3,e.timeout??1e3)};export{U as fromHttp};
